WEBVTT

1
00:00:00.636 --> 00:00:11.756
Welcome to NxSAM training. This module covers Administration - the configuration that shapes how work is recorded, rather than who is allowed to do it.

2
00:00:12.036 --> 00:00:27.311
User access has its own video, and so do the platform's own system settings. What is left here is a smaller set of screens with an outsized effect, because they decide the vocabulary everybody else has to work in.

3
00:00:27.891 --> 00:00:30.278
Start with audit types.

4
00:00:30.844 --> 00:00:48.110
An audit type is the kind of assessment an audit is - an application scan, a manual penetration test, a compliance audit, a red-team engagement. It appears on every audit list in the product and it is one of the most useful things to filter by.

5
00:00:48.690 --> 00:01:03.291
Which is an argument for keeping the list short. Twenty audit types, half of them meaning nearly the same thing, and the filter stops being useful - because nobody is confident which one a given audit was recorded under.

6
00:01:03.895 --> 00:01:14.463
A good test: could two people, given the same audit, independently pick the same type? If not, the distinction is too fine to be worth having.

7
00:01:15.071 --> 00:01:20.051
Audit properties are how you record what the product does not ask for.

8
00:01:20.669 --> 00:01:36.498
Each has a property name, a property type, and who created it. The type is what matters - a property defined as a list gives you something you can filter and report by; one defined as free text gives you something you can only read.

9
00:01:37.111 --> 00:01:53.778
So the rule is simple. Anything you will ever want to count, group by, or filter on must be a chosen value rather than typed prose. Free text is for the sentence that explains the exception, not for the exception itself.

10
00:01:54.397 --> 00:02:07.778
Typical properties are the ones your organisation is asked about and the product has no opinion on: an engagement code, the methodology that was followed, the scope document it was agreed against.

11
00:02:08.391 --> 00:02:19.726
Property management is where those fields are then attached to the places they should appear, so an audit type that needs a contract reference asks for one and the others do not.

12
00:02:20.358 --> 00:02:33.569
That targeting is worth doing rather than adding every property everywhere. A form with four relevant fields gets filled in properly; a form with fourteen gets filled in with whatever passes validation.

13
00:02:34.192 --> 00:02:38.932
The status masters are the vocabulary the whole platform speaks.

14
00:02:39.525 --> 00:02:50.143
Audit statuses, priority statuses and risk statuses each have their own master list, and every list and report in the product draws its words from these.

15
00:02:50.727 --> 00:03:03.722
Which makes them powerful and worth treating carefully. Renaming a status renames it everywhere, including in documents you have already produced and conversations people are already having.

16
00:03:04.339 --> 00:03:23.767
The one thing worth checking rather than assuming is which statuses count as closed. A finding is only out of your open figures if its status is one the platform treats as closed - and adding a new status that sounds final without that flag is how a count stops moving for no visible reason.

17
00:03:24.387 --> 00:03:31.359
Then the scheduled emails, which are how most people experience this platform without ever opening it.

18
00:03:31.920 --> 00:03:40.335
Each template is a scenario with a frequency, the day it is triggered on, the time it is triggered at, and its status.

19
00:03:40.954 --> 00:04:05.303
Send, new in this release, sends a scheduled template now - off-schedule, to the recipients it would resolve to at the next scheduled send. It does not move the schedule: the next send still happens when it was due. The email log records which of the two sent a given mail, which is the first thing to check when a recipient reports the same report twice on one day.

20
00:04:05.881 --> 00:04:21.106
Read Triggered On and Triggered At together with the frequency, because that combination is where the mistakes are. A weekly email triggered on a Saturday reaches people on Monday, by which time it describes last week.

21
00:04:21.686 --> 00:04:37.159
Send things when somebody can act on them. An overdue report that arrives first thing on a working day gets read; the same report arriving at the weekend gets archived unread, and the failure looks like apathy rather than scheduling.

22
00:04:37.734 --> 00:04:50.494
Status is the other one to watch. A disabled template is not a failure and produces no error - it simply does not send, which looks identical to a template that is broken.

23
00:04:51.093 --> 00:04:53.912
Which is what the email log is for.

24
00:04:54.517 --> 00:05:09.097
It records what was actually sent. When somebody says they are not receiving something, this screen tells you whether the platform sent it - and that single fact decides whether the problem is yours or the mail system's.

25
00:05:09.685 --> 00:05:21.532
For anything more elaborate than these - one report split per owner, per project, per business unit - that is the Custom Email Templates module, which has a video of its own.

26
00:05:22.133 --> 00:05:27.087
Advisories are the least-known screen here and one of the more useful.

27
00:05:27.698 --> 00:05:36.014
Each carries a published weakness identifier, a regulatory name, a date, a status, and who created it.

28
00:05:36.633 --> 00:05:51.114
That regulatory name column is the point of the screen. When a regulator or a national body issues a directive naming a specific weakness, this is where that directive is recorded against the weakness itself.

29
00:05:51.684 --> 00:06:07.966
Which turns an ordinary finding into a mandated one. Everywhere that weakness appears, the guidance travels with it - so the person fixing it sees why it is being treated as urgent, rather than being told separately by somebody chasing them.

30
00:06:08.574 --> 00:06:16.270
It is worth keeping current, because the alternative is a spreadsheet of directives that only one person knows about.

31
00:06:16.843 --> 00:06:21.895
Three more configuration screens, each solving a specific problem.

32
00:06:22.486 --> 00:06:37.951
The scoring configuration decides how a published severity score maps onto the platform's severity levels. It sounds like a technicality and it is not - it is where an industry number becomes your organisation's word for it.

33
00:06:38.552 --> 00:06:47.011
Then network groups and sub-groups, which are how a large estate is divided into meaningful pieces for assessment and reporting.

34
00:06:47.619 --> 00:07:02.968
Group by something durable - a site, a business unit, an environment. Grouping by something that changes, like a project name or a team's current title, gives you a structure that quietly stops matching reality.

35
00:07:03.598 --> 00:07:10.328
And report test cases, categories and plans, which are for a specific kind of organisation.

36
00:07:10.957 --> 00:07:20.111
They let you record the methodology a report followed: the cases that were tested, grouped into categories, assembled into a plan.

37
00:07:20.693 --> 00:07:35.008
That matters when somebody has to demonstrate not just what was found, but what was looked for. A report saying no findings is a very different document depending on whether forty checks were performed or four.

38
00:07:35.632 --> 00:07:49.131
If you are assessed against a methodology - by a regulator, a client, or a certification - this is where that methodology stops being a document somebody keeps and starts being part of the report.

39
00:07:49.723 --> 00:08:13.542
That is Administration. Audit types and your own audit properties. The status masters that give the whole platform its vocabulary. Scheduled email with a log to prove it sent. Advisories that carry regulatory context onto the finding itself. And the grouping, scoring and methodology configuration.

40
00:08:14.128 --> 00:08:30.555
One principle runs through all of it. Anything you will want to count later has to be a chosen value now - a type, a status, a property with a fixed list. Free text is where information goes to become unreportable.

41
00:08:31.142 --> 00:08:45.576
And keep every one of these lists shorter than feels comfortable. The value of a controlled vocabulary is that people pick the same word for the same thing, and that stops being true long before the list stops growing.